⚡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More

Power doesn't just disappear in one big breach. It slips away in the small stuff—a patch that's missed, a setting that's wrong, a system no one is watching. Security usually doesn't fail all at once; it breaks slowly, then suddenly. Staying safe isn't about knowing everything—it's about acting fa...

MAL-2025-33134 Malicious code in shopify-payments-terms (npm)

The package shopify-payments-terms was found to contain malicious code...

Malicious code in shopify-payments-terms (npm)

The package shopify-payments-terms was found to contain malicious code...

MAL-2025-33133 Malicious code in shopify-payments-configuration (npm)

The package shopify-payments-configuration was found to contain malicious code...

MAL-2025-14212 Malicious code in airwallex-online-payments-gateway (npm)

The package airwallex-online-payments-gateway was found to contain malicious code...

Malicious code in payments-quickstart (npm)

The package payments-quickstart was found to contain malicious code...

Malicious code in airwallex-online-payments-gateway (npm)

The package airwallex-online-payments-gateway was found to contain malicious code...

MAL-2025-28945 Malicious code in payments-quickstart (npm)

The package payments-quickstart was found to contain malicious code...

Malicious code in shopify-payments-configuration (npm)

The package shopify-payments-configuration was found to contain malicious code...

MAL-2025-28154 Malicious code in offsite_payments (npm)

The package offsitepayments was found to contain malicious code...

The vulnerability of the web interface of the information system for state and municipal payments in the Republic of Tatarstan (GIS GMPl) stems from errors in the logic of the web application’s operation. This vulnerability allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the web interface of the information system for state and municipal payments in the Republic of Tatarstan GIS GMPl is related to errors in the logic of the web application’s operation. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthoriz...

AI Tools Fuel Brazilian Phishing Scam While Efimer Trojan Steals Crypto from 5,000 Victims

Cybersecurity researchers are drawing attention to a new campaign that's using legitimate generative artificial intelligence AI-powered website building tools like DeepSite AI and BlackBox AI to create replica phishing pages mimicking Brazilian government agencies as part of a financially motivat...

CVE-2025-7653

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress EPay.bg Payments plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin EPay.bg Payments versions = 0.1...

CVE-2025-7653 EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-7653

CVE-2025-7653 describes a stored XSS in the WordPress EPay.bg Payments plugin (versions

CVE-2025-7653 EPay.bg Payments <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The EPay.bg Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'epay' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress plugin EPay.bg Payments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-30109 · WordPress · Epay.Bg Payments

Name of the Vulnerable Software and Affected Versions: EPay.bg Payments plugin for WordPress versions up to and including 0.1 Description: The EPay.bg Payments plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s epay shortcode. Insufficient input sanitization a...

A Bayesian Incentive Mechanism for Poison-Resilient Federated Learning

Federated learning FL enables collaborative model training across decentralized clients while preserving data privacy. However, its open-participation nature exposes it to data-poisoning attacks, in which malicious actors submit corrupted model updates to degrade the global model. Existing defens...